FandaR-IT - Howto install Iptables log Analyzer

Payment Gateways

E-Gold: 2917547

Moneybookers: This e-mail address is being protected from spam bots, you need JavaScript enabled to view it

Paypal: This e-mail address is being protected from spam bots, you need JavaScript enabled to view it

Howto install Iptables log Analyzer

Written by Administrator

Tuesday, 16 September 2008

wget http://jaist.dl.sourceforge.net/sourceforge/iptablelog/iptablelog-v0.9.tar.bz2
tar jxvf iptablelog-v0.9.tar.bz2
mv iptablelog/ /var/www/html
mysql -u root
mysql> create database iptablelog;
mysql> grant all on iptablelog.* to iptablelog_user@localhost identified by 'iptpass'
mysql> exit
cat /var/www/html/iptablelog/conf/iptables.mysql | mysql -u iptablelog_user --password=iptpass

iptablelog
wget ftp://ftp.netfilter.org/pub/ulogd/ulogd-1.24.tar.bz2
tar jxvf ulogd-1.24.tar.bz2
cd ulogd-1.24
./configure --prefix=/usr --sysconfdir=/etc --libdir=/usr/local/lib --with-mysql
&& make && make install
cp ulogd.init /etc/rc.d/init.d/ulogd
/etc/rc.d/init.d/ulogd start
chkconfig --add ulogd
cp /var/www/html/iptablelog/conf/config.php.default /var/www/html/iptablelog/conf/config.php
nano /var/www/html/iptablelog/conf/config.php

change this:
# Password of the MySQL database
$db_password="changeme";
to:
# Password of the MySQL database
$db_password="iptpass";
change this:
# File Path to your installation
$file_base="/path/to/iptablelog"; # i.e. "/var/www/html/iptablelog"
to:
# File Path to your installation
$file_base="/var/www/html/iptablelog"

cp /var/www/html/iptablelog/conf/iptables_resolve.default /etc/cron.hourly/iptables_resolve
nano /etc/cron.hourly/iptables_resolve

change dbsettings to
db_connect(db_connect("localhost","iptablelog","iptablelog_user", "iptpass");

nano /etc/sysconfig/iptables

# Generated by iptables-save v1.3.5 on Thu Aug 7 07:41:51 2008
*filter
:INPUT DROP [20421:9866003]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [17287:2501724]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p udp --dport 53 -j ACCEPT
-A INPUT -p tcp -m multiport --dports 53,80,21,22 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 25 -j DROP
-A INPUT -m limit --limit 1/sec -j ULOG --ulog-prefix "INPUT"
-A INPUT -m limit --limit 1/sec -j LOG --log-prefix "[IPTABLES INPUT] : "
COMMIT
# Completed on Thu Aug 7 07:41:51 2008

/etc/init.d/iptables restart

Add as favourites (28) |

Quote this article on your site | Views: 345

Be first to comment this article

Write Comment

Please keep the topic of messages relevant to the subject of the article. Personal verbal attacks will be deleted. Please don't use comments to plug your web site. Such material will be removed. Just ensure to Refresh your browser for a new security code to be displayed prior to clicking on the 'Send' button. Keep in mind that the above process only applies if you simply entered the wrong security code.
Name:
E-mail
Homepage
Title:
BBCode:
Comment:
Code:*
	I wish to be contacted by email regarding additional comments

Next >

[ Back ]